Certificate Pinning Using a Directory Service

1. A computer-implemented method for providing secure communications between a user device and a server, comprising: performing a certificate pinning operation by i) requesting, by the user device from a directory service that is separate and independent from the server, a set of public key certificates for the server stored by the directory service, ii) receiving, by the user device from the directory service, the set of public key certificates for the server, and iii) storing the set of public key certificates for the server within the user device, wherein the set of public key certificates for the server received from the directory service comprises a set of multiple, individually different public key certificates for the server that are stored by the directory service and that are all sent to the user device by the directory service in response to receipt of the request from the user device by the directory service, and wherein each one of the public key certificates in the set of public key certificates for the server received from the directory service has a different expiration date; performing a server certificate request operation by i) requesting, by the user device from the server, a current public key certificate of the server, ii) receiving, by the user device from the server, the current public key certificate of the server, and iii) storing the current public key certificate of the server within the user device; comparing the current public key certificate of the server received from the server with each public key certificate in the set of public key certificates for the server received from the directory service; in response to the current public key certificate of the server received from the server matching one of the public key certificates in the set of public key certificates for the server received from the directory service, confirming the authenticity of the server and permitting communications between the user device and the server; and preventing subsequent communications between the user device and the server unless the current public key certificate received from the server matches one of the public key certificates in the set of public key certificates for the server received from the directory service.

2. The method of claim 1 , further comprising: initially performing the certificate pinning operation by the user device prior to communicating with the server, to obtain an initial set of public key certificates for the server; initially performing the server certificate request operation by the user device in response to completion of the initial certificate pinning operation, to obtain a first current public key certificate of the server; and preventing subsequent communications between the user device and the server unless the first current public key certificate received from the server matches one of the public key certificates in the initial set of public key certificates for the server received from the directory service, by preventing establishment of a secure connection between the user device and the server.

3. The method of claim 1 , further comprising: periodically performing the certificate pinning operation to obtain an updated set of public key certificates for the server; periodically performing the server certificate request operation to obtain an updated current public key certificate of the server; and preventing subsequent communications between the user device and the server unless the updated current public key certificate received from the server matches one of the public key certificates in the updated set of public key certificates for the server received from the directory service, by tearing down a previously established secure connection between the user device and the server.

4. The method of claim 3 , wherein the certificate pinning operation further includes iv) requesting, by the user device from the directory service, an internet protocol (IP) address associated with a domain name of the server, v) receiving, by the user device from the directory service, the internet protocol (IP) address associated with the domain name of the server, and vi) storing the internet protocol (IP) address associated with the domain name of the server within the user device; and wherein performing the server certificate request operation uses the internet protocol (IP) address associated with the domain name of the server received from the directory service as a destination internet protocol (IP) address of the request for the current public key certificate of the server.

5. The method of claim 1 , wherein the directory service stores multiple public key certificates in association with a domain name of the server; wherein the certificate pinning operation includes transmitting a request including the domain name of the server from the user device to the directory service; and wherein the set of public key certificates for the server received from the directory service includes the multiple public key certificates stored by the directory service in association with the domain name of the server.

6. The method of claim 5 , wherein the set of public key certificates for the server received from the directory service includes a first public key certificate and a second public key certificate, wherein the first public key certificate includes a first expiration date and the second public key certificate includes a second expiration date, the first expiration date being prior to the second expiration date, and further comprising: prior to the first expiration date, preventing subsequent communications between the user device and the server unless the current public key certificate received from the server matches one of either the first public key certificate or the second public key certificate; discarding, by the user device, the first public key certificate on the first expiration date; and after the first expiration date and until the second expiration date, preventing subsequent communications between the user device and the server unless the current public key certificate received from the server matches the second public key certificate.

7. The method of claim 1 , wherein the directory service stores multiple public key certificates for each server in a set of multiple servers, and further comprising: periodically performing the certificate pinning operation at the user device for each one of the multiple servers to obtain an updated set of public key certificates for each one of the multiple servers; periodically performing the server certificate request operation at the user device for each one of the multiple servers to obtain an updated current public key certificate for each one of the multiple servers; and preventing subsequent communications at the user device with each one of the multiple servers unless the updated current public key certificate received from that server matches one of the public key certificates in the updated set of public key certificates for that server received from the directory service.

8. The method of claim 7 , wherein the directory service includes a certificate set database operable to store multiple sets of public key certificates for each one of the multiple servers; and wherein the method further comprises providing a database user interface operable to receive both: i) an indication of a new set of certificates to be loaded into the certificate set database for one of the multiple servers that corresponds to a domain name provided through the user interface, and ii) an indication of whether a set of certificates previously loaded into the certificate set database for the one of the multiple servers is to be either a) invalidated after a predetermined period of time has expired after loading of the new set of certificates into the certificate set database, or b) invalidated immediately after loading of the new set of certificates into the certificate set database.

9. The method of claim 8 , further comprising transmitting, by the directory service to the user device, only the new set of certificates for the one of the multiple servers in response to i) receiving a request from the user device containing the domain name corresponding to the one of the multiple servers, and ii) detecting a user indication that the set of certificates previously loaded into the certificate set database for the one of the multiple servers is to be invalidated immediately after loading of the new set of certificates for the one of the multiple servers into the certificate set database.

10. The method of claim 1 , further comprising: loading a new set of certificates for the server into the directory service, wherein the directory service stores the new set of certificates for the server together with a previously loaded certificate for the server; invalidating the previously loaded certificate in the directory service upon expiration of a predetermined time period following the loading of the new set of certificates for the server; wherein the directory service responds to requests from the user device for the set of public keys for the server prior to expiration of the predetermined time period following the loading of the new set of certificates for the server by sending the new set of public key certificates for the server with the previously loaded certificate for the server to the user device; and wherein the directory service responds to requests from the user device for the set of public keys for the server subsequent to the expiration of the predetermined time period following the loading of the new set of public key certificates for the server into the directory service by sending the new set of public key certificates for the server without the previously loaded certificate for the server to the user device.

11. The method of claim 1 , further comprising: loading a new set of certificates for the server into the directory service together with an indication to immediately invalidate at least one previously loaded certificate for the server at the time of the loading of the new set of certificates; and wherein the directory service responds to requests from the user device for the set of public keys for the server subsequent to loading the new set of public key certificates for the server into the directory service by sending the new set of public key certificates for the server without the previously loaded certificate for the server to the user device.

12. A user device operable to provide secure communications between the user device and a server, comprising: memory; and processing circuitry, the memory storing program code that, when executed by the processing circuitry, causes the processing circuitry to: perform a certificate pinning operation by i) requesting, by the user device from a directory service that is separate and independent from the server, a set of public key certificates for the server stored by the directory service, ii) receiving, by the user device from the directory service, the set of public key certificates for the server, and iii) storing the set of public key certificates for the server within the user device, wherein the set of public key certificates for the server received from the directory service comprises a set of multiple, individually different public key certificates for the server that are stored by the directory service and that are all sent to the user device by the directory service in response to receipt of the request from the user device by the directory service, and wherein each one of the public key certificates in the set of public key certificates for the server received from the directory service has a different expiration date, perform a server certificate request operation by i) requesting, by the user device from the server, a current public key certificate of the server, ii) receiving, by the user device from the server, the current public key certificate of the server, and iii) storing the current public key certificate of the server within the user device, compare the current public key certificate of the server received from the server with each public key certificate in the set of public key certificates for the server received from the directory service, in response to the current public key certificate of the server received from the server matching one of the public key certificates in the set of public key certificates for the server received from the directory service, confirming the authenticity of the server and permitting communications between the user device and the server, and prevent subsequent communications between the user device and the server unless the current public key certificate received from the server matches one of the public key certificates in the set of public key certificates for the server received from the directory service.

13. The user device of claim 12 , wherein the program code, when executed by the processing circuitry, further causes the processing circuitry to: initially perform the certificate pinning operation prior to communicating with the server, to obtain an initial set of public key certificates for the server; initially perform the server certificate request operation in response to completion of the initial certificate pinning operation, to obtain a first current public key certificate of the server; and prevent subsequent communications between the user device and the server unless the first current public key certificate received from the server matches one of the public key certificates in the initial set of public key certificates for the server received from the directory service, by preventing establishment of a secure connection between the user device and the server.

14. The user device of claim 12 , wherein the program code, when executed by the processing circuitry, further causes the processing circuitry to: periodically perform the certificate pinning operation to obtain an updated set of public key certificates for the server; periodically perform the server certificate request operation to obtain an updated current public key certificate of the server; and prevent subsequent communications between the user device and the server unless the updated current public key certificate received from the server matches one of the public key certificates in the updated set of public key certificates for the server received from the directory service, by tearing down a previously established secure connection between the user device and the server.

15. The user device of claim 14 , wherein the program code, when executed by the processing circuitry, further causes the processing circuitry to: perform the certificate pinning operation by further iv) requesting, by the user device from the directory service, an internet protocol (IP) address associated with a domain name of the server, v) receiving, by the user device from the directory service, the internet protocol (IP) address associated with the domain name of the server, and vi) storing the internet protocol (IP) address associated with the domain name of the server within the user device; and perform the server certificate request operation using the internet protocol (IP) address associated with the domain name of the server received from the directory service as a destination internet protocol (IP) address for the request for the current public key certificate of the server.

16. The user device of claim 12 , wherein the directory service stores multiple public key certificates in association with a domain name of the server; wherein the certificate pinning operation includes transmitting a request including the domain name of the server from the user device to the directory service; and wherein the set of public key certificates for the server received from the directory service includes the multiple public key certificates stored by the directory service in association with the domain name of the server.

17. A computer program product having a non-transitory computer readable medium which stores a set of instructions operable to provide secure communications between a user device and a server, the set of instructions, when executed by processing circuitry, causing the processing circuitry to: perform a certificate pinning operation by i) requesting, by the user device from a directory service that is separate and independent from the server, a set of public key certificates for the server stored by the directory service, ii) receiving, by the user device from the directory service, the set of public key certificates for the server, and iii) storing the set of public key certificates for the server within the user device, wherein the set of public key certificates for the server received from the directory service comprises a set of multiple, individually different public key certificates for the server that are stored by the directory service and that are all sent to the user device by the directory service in response to receipt of the request from the user device by the directory service, and wherein each one of the public key certificates in the set of public key certificates for the server received from the directory service has a different expiration date, perform a server certificate request operation by i) requesting, by the user device from the server, a current public key certificate of the server, ii) receiving, by the user device from the server, the current public key certificate of the server, and iii) storing the current public key certificate of the server within the user device, compare the current public key certificate of the server received from the server with each public key certificate in the set of public key certificates for the server received from the directory service, in response to the current public key certificate of the server received from the server matching one of the public key certificates in the set of public key certificates for the server received from the directory service, confirm the authenticity of the server and permitting communications between the user device and the server, and prevent subsequent communications between the user device and the server unless the current public key certificate received from the server matches one of the public key certificates in the set of public key certificates for the server received from the directory service.

18. The computer program product of claim 17 , wherein the program code, when executed by processing circuitry, further causes the processing circuitry to: initially perform the certificate pinning operation prior to communicating with the server, to obtain an initial set of public key certificates for the server; initially perform the server certificate request operation in response to completion of the initial certificate pinning operation, to obtain a first current public key certificate of the server; and prevent subsequent communications between the user device and the server unless the first current public key certificate received from the server matches one of the public key certificates in the initial set of public key certificates for the server received from the directory service, by preventing establishment of a secure connection between the user device and the server.

19. The computer program product of claim 17 , wherein the program code, when executed by processing circuitry, further causes the processing circuitry to: periodically perform the certificate pinning operation to obtain an updated set of public key certificates for the server; periodically perform the server certificate request operation to obtain an updated current public key certificate of the server; and prevent subsequent communications between the user device and the server unless the updated current public key certificate received from the server matches one of the public key certificates in the updated set of public key certificates for the server received from the directory service, by tearing down a previously established secure connection between the user device and the server.

20. The computer program product of claim 19 , wherein the program code, when executed by processing circuitry, further causes the processing circuitry to: perform the certificate pinning operation by further iv) requesting, by the user device from the directory service, an internet protocol (IP) address associated with a domain name of the server, v) receiving, by the user device from the directory service, the internet protocol (IP) address associated with the domain name of the server, and vi) storing the internet protocol (IP) address associated with the domain name of the server within the user device; and perform the server certificate request operation using the internet protocol (IP) address associated with the domain name of the server received from the directory service as a destination internet protocol (IP) address for the request for the current public key certificate of the server.

21. The computer program product of claim 17 , wherein the certificate pinning operation further includes transmitting a request including the domain name of the server from the user device to the directory service; and wherein the set of public key certificates for the server received from the directory service includes multiple public key certificates stored by the directory service in association with the domain name of the server.